Governance matrix
- 1. CENTER FOR Massachusetts INFORMATION Institute of SYSTEMS Technology RESEARCH Sloan School Cambridge of Management Massachusetts IT Governance on One Page Peter Weill Jeanne W. Ross November 2004 CISR WP No. 349 and Sloan WP No. 4516-04 2004 Massachusetts Institute of Technology. All rights reserved. Research Article: a completed research article drawing on one or more CISR research projects that presents management frameworks, findings and recommendations. Research Summary: a summary of a research project with preliminary findings. Research Briefings: a collection of short executive summaries of key findings from research projects. Case Study: an in-depth description of a firm’s approach to an IT management issue (intended for MBA and executive education). Technical Research Report: a traditional academically rigorous research paper with detailed methodology, analysis, findings and references.
- 2. About the Center for Information Systems Research CISR MISSION CISR RESEARCH PATRONS CISR was founded in 1974 and has a strong track BT Group record of practice based research on the management of information technology. As we enter the twenty- DiamondCluster International, Inc. first century, CISR’s mission is to perform practical Gartner empirical research on how firms generate business Hewlett-Packard Company value from IT. CISR disseminates this research via Microsoft Corporation electronic research briefings, working papers, research workshops and executive education. Recent Tata Consultancy Services—America and current research topics include: CISR SPONSORS 2003 PROJECTS Business Models and IT Investments Aetna Inc. Governing IT for Different Performance Goals Allstate Insurance Co. Assessing Architecture Outcomes AstraZeneca Pharmaceuticals, LP Infrastructure as Variable Cost Banknorth, NA Managing IT Related Risks Biogen Idec, Inc. 2004 PROJECTS Campbell Soup Company Assessing the Performance of Alternative Care USA Business Models Celanese Managing the Next Wave of Outsourcing Managing IT Architecture for Business Value ChevronTexaco Corporation Measuring IT-driven Risk Det Norske Veritas (Norway) Exploring the Role of the IT Unit in Leading eFunds Corporation IT-enabled Change EMC Corporation Since July 2000, CISR has been directed by Peter Weill, The Gillette Company formerly of the Melbourne Business School. Drs. Jeanne The Guardian Life Insurance Company of America Ross, George Westerman and Nils Fonstad are full time CISR researchers. CISR is co-located with MIT Sloan’s Intel Corporation Center for e-Business and Center for Coordination International Finance Corp. Science to facilitate collaboration between faculty and Merck and Company researchers. Merrill Lynch & Co., Inc. CISR is funded in part by Research Patrons and Sponsors and we gratefully acknowledge the support and MetLife contributions of its current Research Patrons and Mohegan Sun Sponsors. Motorola, Inc. CONTACT INFORMATION National Kidney Foundation, Singapore Center for Information Systems Research Nomura Research Institute, Ltd. MIT Sloan School of Management 3 Cambridge Center, NE20-336 Pasco County, Florida Cambridge, MA 02142 Pfizer, Inc. Telephone: 617/253-2348 PFPC, Inc. Facsimile: 617/253-4424 http://web.mit.edu/cisr/www Qwest Communications Raytheon Company Peter Weill, Director pweill@mit.edu State Street Corporation David Fitzgerald, Asst. to the Director dfitz@mit.edu Jeanne Ross, Principal Res. Scientist jross@mit.edu Telenor ASA George Westerman, Res. Scientist georgew@mit.edu TRW Automotive, Inc. Nils Fonstad, Research Scientist nilsfonstad@mit.edu Jack Rockart, Sr. Lecturer Emeritus jrockart@mit.edu Chuck Gibson, Sr. Lecturer cgibson@mit.edu Chris Foglia, Center Manager cfoglia@mit.edu Julie Coiro, Admin. Assistant julieh@mit.edu
- 3. CISR Working Paper No. 349 Title: IT Governance on One Page Author: Peter Weill and Jeanne W. Ross Date: November 2004 Abstract: As firms strive to generate value from information technology (IT), managers are increasingly aware that IT-related decisions and behaviors must be aligned with organizational performance goals. But many individuals throughout organizations make daily decisions influencing the value received from IT. IT governance is the process by which firms align IT actions with their performance goals and assign accountability for those actions and their outcomes. To be effective, IT governance must be actively designed, not the result of isolated mechanisms (e.g. steering committee, office of IT architecture, service level agreements) implemented at different times to address the challenge of the moment. Based on the best practices of 300 enterprises in 23 countries this paper offers an assessment and a one-page framework to help firms design and communicate IT governance. Keywords: IT governance, governance framework 15 Pages
- 4. IT GOVERNANCE ON ONE PAGE Peter Weill, Senior Research Scientist and Director, CISR, Jeanne W. Ross, Principal Research Scientist, CISR, MIT Sloan School of Management Companies with effective IT governance have profits that are 20% higher than other companies pursuing similar strategies.1 One viable explanation for this differential is that IT governance specifies accountabilities for IT-related business outcomes and helps companies align their IT investments with their business priorities. But IT governance is a mystery to key decision makers at most companies. Our research indicates that, on average, only 38% of senior managers in a company know how IT is governed. Ignorance is not bliss. In our research senior management awareness of IT governance processes proved to be the single best indicator of governance effectiveness with top performing firms having 60, 70 or 80% of senior executives aware of how IT is governed. Taking the time at senior management levels to design, implement, and communicate IT governance processes is worth the trouble—it pays off. In our study of almost 300 enterprises around the world, we did not identify a single best formula for governing IT. However, one thing is clear: effective IT governance doesn’t happen by accident. Top performing enterprises carefully design governance. Managers throughout the enterprise make daily decisions putting that design into practice. IT governance is the decision rights and accountability framework for encouraging desirable behaviors in the use of IT. IT governance reflects broader corporate governance principles while focusing on the management and use of IT to achieve corporate performance goals. Because IT outcomes are often hard to measure, firms must assign responsibility for desired outcomes and assess how well they achieve them. IT governance shouldn’t be considered in isolation because IT is linked to other key enterprise assets (i.e. financial, human, intellectual property, physical and relationships). Thus, IT governance might share mechanisms (such as executive committees and budget processes) with other asset governance processes, thereby coordinating enterprise- wide decision making processes. Every enterprise engages in IT decision making, but firms differ considerably in how thoughtfully they define accountability and how rigorously they formalize and communicate decision making processes. Without formal IT governance individual managers are left to 1 Weill, P. and Ross, J. How Top Performers Manage IT Decision Rights for Superior Results, Harvard Business School Press, 2004. The authors would like to gratefully acknowledge all the managers who participated in the research as well as Marianne Broadbent, Mark McDonald and their Gartner colleagues. We also would like to acknowledge the MIT Sloan CISR Patrons and Sponsors for supporting this research. This paper is based on two studies led by the authors. The first, a survey of CIOs at 256 enterprises in the Americas, Europe, and Asia Pacific on how enterprises govern IT, was developed by MIT Sloan’s Center for Information Systems Research in 2001 and distributed throughout 2002 electronically and on paper by Gartner to members of its EXP group and by CISR to participants in executive courses. Gartner additionally contributed to the research by conducting ten case studies on IT governance. The second was a set of 40 interview based case studies examining IT governance in the context of organizational changes such as ERP implementations, e-business initiatives, enterprise architecture development, and IT-enabled organizational transformations. These cases were developed by CISR researchers between 1995–2004. To understand how top performing enterprises governed IT, MIT CISR researchers analyzed the data using both statistical and qualitative analysis. The paper draws on and then extends the material in IT Governance: How Top Performers Manage IT Decision Rights for Superior Results,, P. Weill & J. Ross, Harvard Business School Press, 2004.
- 5. resolve isolated issues as they arise. These individual actions can be at odds. For example, the CIO at a global transportation firm was instructed to cut the corporate IT budget. This CIO introduced a chargeback system to curtail demand for IT services. Unhappy with their new charges managers within each of the business units hired technical specialists to provide services at a price they were willing to pay. The new technical specialists did not show up in the corporate IT budget so it looked like the CIO had achieved his goal, but the impact of the new business unit hires was to increase rather than decrease the firm’s total IT spending. Worse, the business unit employees developed local services that compromised the integrity of enterprise data and undermined customer service for those customers served by more than one business unit. In contrast, when UNICEF’s senior managers recognized that IT was playing an increasingly strategic (and expensive) role in enabling the organization’s mission of delivering services to children, the senior management team took responsibility for ensuring that IT met organizational goals. They held division directors accountable for implementation of global systems, and the CIO was held accountable for delivering key infrastructure services. Over the past few years, IT has fundamentally transformed the way UNICEF operates. A QUICK ASSESSMENT OF YOUR IT GOVERNANCE We assess an enterprise’s or business unit’s governance performance by evaluating the effectiveness of IT governance in delivering four objectives weighted by their importance to the enterprise. • Cost effective use of IT • Effective use of IT for asset utilization • Effective use of IT for growth • Effective use of IT for business flexibility When assessing governance performance senior managers first identify the relative importance of each of the four factors in their enterprises and then rate enterprise performance on each factor. Using a weighted average formula a score out of 100 is calculated. Figure 1 contains the questions and formula to calculate governance performance so any enterprise or business unit can benchmark itself with our research results. We suggest you complete Figure 1 now to compare your enterprise with the results that follow. For a more reliable evaluation ask a group of your senior colleagues to also complete the assessment and discuss the results. Governance performance varies significantly across enterprises and is approximately bell shaped. The average governance performance score was 69 out of 100. The minimum score was 20 and the top third performing firms had scores over 74. Only 17% of enterprises scored 80 or above and only 7% scored 90 or over. Achieving high governance performance meant that the enterprise’s IT governance was successful in influencing the desired measures of success. How does your enterprise compare? Were you above average? In which of the four areas was your enterprise weakest? What do you think are the reasons for your governance performance score? How urgent is the case for action? © 2004 MIT Sloan—Weill and Ross Page 2
- 6. Figure 1: Assess Your IT Governance Performance Figure 1: Assess Your IT Governance Performance 1. Question: 2. Question: How important are the following What is the influence of the IT governance in outcomes of your IT governance your business on the following measures of on a scale from 1 (not important) success on a scale from 1 (not successful) to 5 to 5 (very important)? (very successful)? a. Cost effective use of IT X = b. Effective use of IT for growth X = c. Effective use of IT for asset utilization X = d. Effective use of IT for business flexibility X = Importance Total = Total = 3. Calculate governance performance: ( Total x 100) ÷ (5 x Importance Total ) = ©2004 MIT Sloan Center for Information Systems Research © 2004 MIT Sloan Center for Information Systems Research Firms with above average IT governance following a specific strategy (e.g. customer intimacy) had 20% higher ROAs than firms with poorer governance following the same strategy. The governance performance measure also statistically significantly correlates with several three-year average measures of financial performance (e.g., ROE and market capitalization growth). We are not saying governance performance caused superior financial performance. However, we can say superior financial performers have high governance performance, and we can study how those enterprises governed. IT GOVERNANCE ON ONE PAGE To evaluate and compare IT governance we propose a matrix representing IT governance on one page mapping how key decisions are made. IT governance encompasses five major decisions related to the management and use of IT in a firm: 1. IT principles: high-level decisions about the strategic role of IT in the business. 2. IT architecture: an integrated set of technical choices to guide the organization in satisfying business needs. 3. IT infrastructure: centrally coordinated, shared IT services providing the foundation for the enterprise’s IT capability and typically created before precise usage needs are known. © 2004 MIT Sloan—Weill and Ross Page 3
- 7. 4. Business application needs: business requirements for purchased or internally developed IT applications. 5. Prioritization and investment: decisions about how much and where to invest in IT, including project approval and justification techniques. Each of these decisions can be made by corporate, business unit, or functional managers—or some combination. And senior management can hold business unit or IT managers accountable for the related outcomes. Thus, the first step in designing IT governance is to determine who should make, and be held accountable for, each decision area. To help think about who should make these decisions, Figure 2 provides a sample of the questions each decision area should cover. Figure 2: Key Issues for each IT Decision IT Principles How do the business principles translate to IT principles to guide IT decisions making? What is the role of IT in the business? What are IT desirable behaviors? How will IT be funded? IT Architecture What are the core business processes of the enterprise? How are they related? What information drives these core processes? How must this data be integrated? What technical capabilities should be standardized enterprise-wide to support IT efficiencies and facilitate process standardization and integration? What activities must be standardized enterprise-wide to support data integration? What technology choices will guide the enterprise’s approach to IT initiatives? IT Infrastructure What infrastructure services are most critical to achieving the enterprise’s strategic objectives? What infrastructure services should be implemented enterprise-wide and what are the service-level requirements of those services? How should infrastructure services be priced? What is the plan for keeping underlying technologies up-to-date? What infrastructure services should be outsourced? Business Application What are the market and business process opportunities for new business applications? Needs How are strategic experiments designed to assess success? How can business needs be addressed within architectural standards? When does a business need justify an exception to standard? Who will own the outcomes of each project and institute organizational changes to ensure the value? IT Investment and What process changes or enhancements are strategically most important to the enterprise? Prioritization What is the distribution in the current IT portfolio? Is this portfolio consistent with the enterprise’s strategic objectives? What is the relative importance of enterprise-wide versus business unit investments? Do actual investment practices reflect their relative importance? What is the right balance between top down and bottom projects to balance standardization and innovation? ©2004 MIT Sloan Center for Information Systems Research Enterprises use one of six decision making archetypes to make each decision. We list these archetypes roughly in order from more to less centralized: 1. Business monarchy: A senior business executive or a group of senior executives, sometimes including the CIO. 2. IT monarchy: Individual or groups of IT executives. 3. Federal: C-level executives and business representatives of all the operating groups—may include IT involvement (equivalent of the central government and the states working together). 4. IT duopoly: Two party decision making involving IT executives and one group of business leaders. © 2004 MIT Sloan—Weill and Ross Page 4
- 8. 5. Feudal: Business unit or process leaders making separate decisions based on the needs of their entities. 6. Anarchy: Each individual user or small group. The five decisions and six archetypes provide the columns and rows for a 5x6 matrix which we refer to as IT governance on one page (see Figure 3). Figure 3: IT Governance on One Page More Domain IT infra- Business IT IT IT structure Application Archetype Principles Architecture Investment Strategies Needs Business Centralized Monarchy IT Monarchy Federal IT Duopoly Feudal Anarchy Less Don’t Know © 2004 MIT Sloan Center for Information Systems Research The matrix allows management to specify, analyze and communicate where IT decisions are made. For example, at UPS, a subset of the senior management team takes responsibility for defining IT principles and IT investment. The CIO’s team is held accountable for IT architecture and IT infrastructure decisions. Finally, business unit leaders and four enterprise-wide process managers accept primary responsibility for defining business application needs. A simple representation of UPS’ governance arrangements is shown in Figure 4, reflecting a clear and relatively centralized approach to IT governance.2 UPS’ governance arrangements reflect the firm’s commitment to offer total, integrated solutions to customers’ global commerce needs. Senior management accountability for principles and investment decisions ensures that IT issues are incorporated into the firm’s strategic decision making processes. The CIO, who is a member of the senior management team, translates principles and investment decisions into IT standards, policies and processes. Business unit projects, delivered in the context of business and IT principles, aim to enhance business unit performance in support of corporate objectives. 2 Ross, J.W. “United Parcel Service: Delivering Packages and e-Commerce Solutions,” CISR Working Paper No. 318, MIT Sloan School of Management Center for Information Systems Research, 2001. © 2004 MIT Sloan—Weill and Ross Page 5
- 9. Figure 4: How UPS Allocates IT Decision Rights Decision IT infra- Business IT IT IT structure application Archetype principles architecture investment strategies needs Business Monarchy X X IT Monarchy X X Federal X Duopoly Feudal Anarchy Researcher interpretation of UPS governance arrangements based on interviews with senior executives on the firm’s IT steering committee. © 2004 MIT Sloan Center for Information Systems Research UPS’ IT governance arrangements create strategic control at the top of the firm while empowering decision making at multiple organizational levels. Senior management works to make IT governance transparent so that everyone understands and follows prescribed processes for proposing, implementing and using IT. This transparency limits the role of organizational politics in IT-related decisions. As a result, UPS is consistently able to generate desirable behaviors with regard to the management and use of IT in the firm. It shows in the firm’s bottom-line performance. GOVERNANCE MECHANISMS ENACT GOVERNANCE ARRANGEMENTS A completed matrix of governance on one page maps out the types of decisions, the archetypes for making those decisions and how these decisions will be made and monitored. This last step requires the design and implementation of a coordinated set of governance mechanisms, such as committees, budget processes, service level agreements, chargeback, architecture processes, etc. It is these mechanisms that managers work with daily as governance is enacted. For example, UPS has thoughtfully designed four coordinated governance mechanisms to implement the company’s intended governance arrangements: (a) an IT steering committee comprising four top executives who accept primary responsibility for principles and investment decisions; (b) an IT governance committee of senior IT executives responsible for key architecture decisions; (c) a formal “charter” process that winnows down the entire enterprise’s IT project proposals to those best aligned with strategic objectives; and (d) an escalation process to handle exceptions to architecture standards at the appropriate organizational level. These four mechanisms clarify processes and accountabilities so that individuals throughout the company can make decisions that result in desirable behavior as defined at UPS. Enterprises design three kinds of governance mechanisms: (1) decision making structures, (2) alignment processes, and (3) formal communications. © 2004 MIT Sloan—Weill and Ross Page 6
- 10. Decision Making Structures. The most visible IT governance mechanisms are the organizational committees and roles that locate decision-making responsibilities according to intended archetypes. Different archetypes rely on different decision making structures. Anarchies (which are rarely used—or at least rarely admitted to!) require no decision making structures at all. Feudal arrangements rely on local decision making structures. But monarchy, federal or duopoly arrangements demand decision making structures with the representation and authority to produce enterprise-wide synergies. Alignment Processes. Effective governance is as much about actions as decisions. Alignment processes are IT management techniques for securing widespread involvement in the effective management and use of IT. Alignment processes should bring everybody on board by both providing input into governance decisions and formalizing the processes implementing those decisions. Key alignment processes include the IT investment proposal process, architecture exception process, service level agreements, chargeback, project tracking and formal tracking of business value from IT. Formal Communications. Communication mechanisms are intended to “spread the word” about IT governance decisions and processes and related desirable behaviors throughout the enterprise. A huge barrier to effective governance is lack of understanding about how decisions are made or about processes for using IT effectively in the firm. Management can communicate governance mechanisms in a variety of ways: senior management announcements, formal committees, office of the CIO or office of IT governance, working one-on-one with nonconformists and web-based portals. Like alignment processes we found that the more management communicated formally about the existence of IT governance mechanisms, the more effective their governance. Well-designed, well-understood and transparent mechanisms promote desirable IT behaviors and individual accountability. These mechanisms implement an enterprise’s intended governance arrangements. But what governance design will work best? We have found that effective governance design depends on a firm’s strategic objectives and organizational structure. Thus, we cannot describe a single best governance design. We can, however, learn from the efforts of top performers. HOW TOP PERFORMERS GOVERN Ultimately, effective IT governance should be visible in business performance metrics. Although many other factors influence financial performance measures, strong performance provides confidence the firm is governing IT effectively. Given different strategies and organizational forms, different enterprises will attempt to encourage different behaviors. Accordingly, governance arrangements can vary from more centralized approaches (most notably monarchies) to more decentralized approaches (most notably feudal designs), with federal and some duopoly designs straddling the two. See Figure 5 for a description of these different approaches. Similarly, some governance mechanisms support more centralized approaches (such as executive committees and centralized capital approval process). Others support more hybrid approaches (such as business/IT relationship managers and service level © 2004 MIT Sloan—Weill and Ross Page 7
- 11. agreements).3 Decentralized approaches deploy very few mechanisms often focused on risk management and vendor management. Figure 5: Governance Lessons from Top Performers Performance* Profit Asset Utilization Growth Profitability via enterprise- Efficient operation by Encourage BU innovation Strategic Driver wide integration and focus encouraging sharing and with few mandated on core competencies. reuse processes ROI/ROE and business Key Metrics process costs ROA and unit IT cost Revenue growth Enterprise-wide Business/IT relationship management Budget approval and risk manager Key IT mechanisms (e.g., management Process teams with IT executive committee) Local accountability Governance Architecture process members Portals or other Mechanisms SLA & chargeback Capital approval information/services IT leadership decision Tracking of business sources making body value of IT Local customized Layers of centrally Shared services centrally IT Infrastructure mandated shared services coordinated capability with few required shared services Low business costs Low IT unit costs; reuse of Local innovation with Key IT through standardized standard models or communities of practice; Principles business processes services optional shared services More centralized Blended More decentralized Governance E.g., Monarchies & E.g., Federal & Duopolies E.g., Feudal Federal arrangements; risk management emphasis * Based on analysis of firms with statistically significantly higher three year industry adjusted performance: Profit (ROI/ROE), Asset Utilization (ROA), Growth (Revenue Growth) © 2004 MIT Sloan Center for Information Systems Research Top performing firms govern significantly differently from other firms. And top performers on one performance metric vary in their approach to governance relative to top performers on other performance metrics. We investigated the IT governance patterns of leaders on the following three dimensions of financial performance:4 (a) profit as measured by return on equity (ROE), return on investment (ROI), and percent profit margin; (b) asset utilization as measured by return on assets (ROA); and (c) growth as measured by percent change in revenue per annum. Centralized Approaches to IT Governance In our research, top performing firms on profit tended to be centralized in their approach to IT governance. As shown in Figure 5, these firms’ strategies emphasize efficient operations often focusing on measures of business process cost and profitability. Accordingly, desirable IT behavior embodies a high degree of standardization in the pursuit of low business costs. Key governance mechanisms include executive committees for decision making, centralized processes for architecture compliance and exceptions, enterprise-wide IT investment decision 3 For a discussion of hybrid governance arrangements see Brown, Carol V. “Examining the Emergence of Hybrid Governance Solutions: Evidence from a Single Case Site,” Information Systems Research (8:1), March 1997, pp. 69–94. 4 The analysis was adjusted for industry differences so that firms were compared to competitors rather than absolute differences in financial performance. © 2004 MIT Sloan—Weill and Ross Page 8
- 12. processes, and formal post-implementation assessments of IT-related projects. More centralized governance enables standardization of both business processes and IT. UNICEF (the United Nations Children’s Fund) is an example of an organization that has instituted a centralized approach to IT governance. While UNICEF is not for profit and thus profitability is not an issue, principles embracing integrated, cost-effective IT and business process capabilities and rapid organizational learning led UNICEF to adopt a centralized IT governance model. For years, IT at UNICEF supported administrative tasks at headquarters but was nearly nonexistent in the field offices where the needs of children were directly addressed. UNICEF operates in remote and sometimes dangerous locations including sites affected by armed conflict, natural disasters and other tragedies. In the mid-1990s senior management recognized that the lack of IT in field offices was handcuffing operations. Led by CIO Andre Spatz, UNICEF equipped remote locations with valuable IT services. The decisions guiding the provisioning of those services involved important tradeoffs among features like cost, reliability, speed and accessibility. The CIO worked with the other C-level managers to establish priorities and take those decisions. Through the leadership of the CXOs, IT has fundamentally transformed the way UNICEF operates and has improved global knowledge, information flow, transparency and communication. Field offices can serve their constituents based on transaction-level and value-added information they could not access only a few years ago. Decentralized Approaches to IT Governance Top performers on growth were more focused on innovation and time to market. These firms insist on local accountability. They measure success through growth in revenues—often revenues generated from products introduced in the last two or three years. Top performers on growth minimize constraints on creativity and business unit autonomy by establishing few, if any, enterprise-wide technology and business process standards. Accordingly, they require few governance mechanisms, often relying only on an investment process that identifies high priority strategic projects and manages risk. What results is responsiveness to local customer needs, high growth and little enterprise wide standardization. Manheim Auctions, the US market leader in business to business car auctions, recognized during the early years of e-commerce that the Internet would offer opportunities to grow its business.5 Starting in the late nineties, Manheim introduced online auction capabilities and experimented with related revenue-generating electronic capabilities. One service, the Manheim Market Report, generated significant value by providing online information on the firm’s auctions to car dealers and other industry participants. To launch its fast growth online business and reinforce its industry dominant position Manheim created an independent business unit, Manheim Online. Hal Logan, the CEO of Manheim Online, worked with the Manheim senior management team to define principles and strategic business requirements. Like most high growth start-ups, the firm did not tightly govern architecture or infrastructure, focusing instead on managing projects for rapid development. Manheim’s development teams were responsible for all aspects of deploying a new Manheim 5 For more information see <http://www.manheim.com> and Weill, P. and Woodham, R., “Manheim Interactive: Selling Cars on Line,” CISR Working Paper No. 314, MIT Sloan Center for Information Systems Research, Cambridge, 2001. © 2004 MIT Sloan—Weill and Ross Page 9
- 13. Online service: product management, deploying of the web servers, development of the service and quality assurance of the service. Manheim’s decentralized approach to IT governance allowed the firm to innovate and grow its business base. Eventually development teams’ focus on speed of system delivery became unsustainable in the context of the larger firm. At that point, Manheim identified a need for greater attention to a more centralized architecture and reusable infrastructure services. Today the online business is integrated into the overall Manheim Auctions business model, relying on a set of shared IT services. Accordingly, IT governance has transitioned to a blend of centralized and decentralized arrangements. Hybrid Approaches to IT Governance Firms pursuing asset utilization attempt to balance the contrasts between governance for profitability and governance for revenue growth and innovation. These firms focus on using shared services to achieve either customer responsiveness or economies of scale—or both. Their IT principles emphasize sharing and reuse of process, system, technology and data modules. Leaders on asset utilization typically rely on duopolies and federal governance design. They introduce governance mechanisms to address the tensions between enterprise-wide and local control. Mechanisms include business-IT relationship managers, service level agreements and IT chargeback, IT leadership teams comprising business unit IT representatives, and process teams with IT members. Asset utilization demands a hybrid approach to governance mixing elements of centralized and decentralized governance. The hybrid approach was common among the firms we studied, but it demands a great deal of management attention. ING DIRECT, the award-winning international direct banking unit of Dutch financial services conglomerate ING, takes a hybrid approach to IT governance. ING DIRECT is organized into eight country-based businesses. Each country unit operates autonomously but the units share a common, “standardized” business model. The bank leverages standardized business solutions as well as standardized technical and infrastructure components in offering a product set featuring savings accounts, term deposits, personal loans/mortgages, retirement savings plans and a few selected mutual funds. ING DIRECT’s IT governance uses duopoly arrangements for all its IT governance decisions. The key mechanism in its duopoly is the Information Technology and Operations Council (CIO’s and COO’s of the country businesses with the Head Office CIO/COO). The Council makes enterprise-wide principles, architecture, infrastructure and investment decisions. The Council holds semi-annual meetings in which the CIOs meet on Monday, the COOs meet on Thursday and the two groups meet jointly on Tuesday and Wednesday. These meetings offer a forum for coordinating the IT Plan with the businesses’ Mid Term Plan. The outcome of this meeting serves as input for the ING DIRECT Council (executive team meeting) where the international business strategy is discussed and defined. In doing so, ING DIRECT allows IT capabilities to influence business strategy just as strategy influences IT. To facilitate development and reuse of business process modules, ING DIRECT looks to its local businesses for innovations. If a country unit wants to introduce a new product, country managers develop a product proposal detailing financial and business implications and risks. A “Product Committee” at the firm’s Head Office approves all new products based on a thorough and detailed review process involving all business units. The outcome of this selection process is a © 2004 MIT Sloan—Weill and Ross Page 10
- 14. global standard rather than an isolated local solution. In addition, the Chief Architect helps define application specifications so that the new application modules work effectively with existing modules and fit with ING DIRECT’s business, application and technical architecture. This arrangement supports ING DIRECT’s desirable behaviors of building modules for reuse, standardizing applications and achieving a universally compatible architecture. Carlson Companies embodies a different approach to hybrid IT governance.6 Carlson is a $20 billion privately owned conglomerate in the marketing, hospitality and travel business. Carlson has grown through acquisition with operating groups in relationship marketing services, loyalty programs (Gold Points Reward Network), hotels (Radisson, Regent International), restaurants (T.G.I. Friday’s), cruises and travel services. In 2000 Chairman and CEO Marilyn Carlson Nelson articulated a vision of presenting Carlson customers with an integrated view of Carlson’s businesses. Traditionally, each operating group functioned independently and was even encouraged to compete with other operating groups. Nelson intended to change the relationship between operating groups from competition to collaboration. She enlisted CIO Steve Brown to map out the technological underpinnings for this change. Brown, who reports directly to the CEO, was given responsibility for defining the role of IT for the integrated enterprise. Brown defined two IT principles: 1. Application development can continue to take place within operating groups, but applications should be presented to users through a shared portal, and, where necessary, data will be shared across business units. 2. Carlson will have a shared IT infrastructure. To translate these principles into IT architecture, infrastructure, business applications and IT investment decisions, Carlson assigned IT governance responsibilities to five decision making structures: (1) the Carlson Technology Architecture Committees (CTAC) residing in each operating group who take responsibility for meeting the unique needs of the individual businesses; (2) the Enterprise Architect Organization (EAO), a team of business unit IT representatives who set corporate-wide standards guiding the development efforts of all the operating units; (3) the IT Council, made up of the CTOs and CIOs of each operating group, which meets monthly to talk about new technologies, and ways technology can be leveraged across Carlson; (4) the Carlson Shared Services Board, the business unit CIOs and CFOs, who meet to identify opportunities to provide shared IT and financial services to the firm; (5) an Investment Committee, made up of a subset of the Executive Committee, which gives final judgment on all large Carlson Companies investment projects. Figure 6 shows our view of Carlson’s governance arrangements, reflecting responsibility for both decisions and input to those decisions. Glancing across Figure 6 provides insight as to which IT decisions are more centralized (e.g. investment) and less centralized (e.g. business application needs). These governance arrangements attempt to maximize opportunities to 6 For a more complete description of IT governance at Carlson Companies, see Chapter 4 of How Top Performers Manage IT Decision Rights for Superior Results, P. Weill and J. Ross, Harvard Business School Press, 2004. © 2004 MIT Sloan—Weill and Ross Page 11
- 15. leverage shared services while minimizing constraints on the unique needs of related, but distinct, operating requirements across diverse business units. Figure 6: Governance at Carlson Companies Decision Domain IT Business IT IT Principles Infrastructure Application IT Investment Architecture Strategies Needs Input Decision Input Decision Input Decision Input Decision Input Decision Business Chairman Invest Monarchy & CEO Comm Governance Archetype IT CIO EAO CIO Most Monarchy EAO common • Architec- Funding patterns in ture Federal excep- authori- all firms zation tion IT IT Council IT Services Council CSS Duopoly Catalog CSS Board Board CIO • Biz CIOs •All Biz • Some Feudal CTAC Leaders Biz Ldrs • CTAC Governance Mechanisms: EAO Enterprise Architecture Organization Invest Comm Subset of executive committee IT Council CIOs and CTO of operating groups CIO CIO Staff CSS Board Carlson Shared Services: CFO and CTO of each operating group CTAC Carlson Technology Architecture Group (one in each operating group) ©2004 MIT Sloan Center for Information Systems Research Large, global companies often require the benefits of a hybrid IT governance model so they can achieve both the synergies emphasized in more centralized models and the autonomy allowed by more decentralized models. Carlson and ING DIRECT achieve this hybrid model in the way they have designed IT governance at the enterprise level. Firms like Dupont, JPMorganChase and Johnson & Johnson achieve these benefits by implementing IT governance at three levels: the enterprise, the region or group of businesses and the business unit. JPMorganChase, for example, encourages autonomy across its businesses in order to generate innovation and recognize the very different requirements of businesses that range from credit cards to investment banking. But the firm has instituted some enterprise-wide IT principles to encourage the use of standardized technologies where they can provide economies of scale. At the division level, JPMorganChase businesses have introduced governance mechanisms that facilitate sharing of customer data so that business units can, when appropriate, present a single face to the customer. At the individual business unit level, each business can design the IT governance arrangements that best address its needs for synergy and autonomy. Firms attempting to realize cost-savings by capitalizing on business unit synergies often look to shared services to remove duplication or reduce IT unit costs. Dupont, for example, has an enterprise IT architecture group with representatives from all regions, all strategic business units, and all competency centers. This group proposes architecture rules to a team consisting of the corporate CIO and the CIOs of the largest business units. This senior IT management team makes © 2004 MIT Sloan—Weill and Ross Page 12
- 16. sure the rules make sense for the businesses and takes responsibility for enforcing architectural standards. Enterprise level governance mechanisms, like DuPont’s architecture rules and senior IT management team, establish parameters for IT governance design at lower organizational levels. RECOMMENDATIONS TO GUIDE EFFECTIVE IT GOVERNANCE DESIGN Effective IT governance demands that senior managers define enterprise performance objectives and actively design governance to facilitate desirable behaviors consistent with those objectives. Often firms have mature business governance processes to use as a starting point in designing IT governance.7 For example, Tennessee Valley Authority (TVA) piggybacked its IT governance on its more mature business governance mechanisms, such as its capital investment process. TVA’s IT governance included a project review committee, benchmarking and selective chargeback—all familiar mechanisms from the engineering side of the business.8 Firms can use the framework of IT governance on one page to help design structures and processes that enhance their strategic use of IT. To use the framework effectively, management teams must first establish the context for IT governance. This involves clarification of how the firm will operate, how the firm’s structure will support its operations and what governance arrangements will elicit the desirable behaviors that structure cannot ensure. Governance arrangements generally transcend organizational structure and can be more stable than structure. We propose that IT governance design should encompass the following four steps. First, identify the firm’s needs for synergy and autonomy. Senior managers are often enamored of the potential to derive business value from synergistic efforts like cross-selling, standard technology platforms or enterprise-wide business processes. We encourage management teams to consider realistically both the benefits and costs of synergies. Synergy-autonomy tradeoffs force senior managers to make tough decisions and communicate those decisions throughout the enterprise. Clarifying those decisions establishes the parameters for the design of IT governance and accompanying managerial incentives. Second, establish the role of organization structure. Firms have long relied on organization structure to create the context for achieving organizational objectives. For some time, this resulted in pendulum-like swings between centralized and decentralized organizational forms. Over time, firms pursued both centralization and decentralization simultaneously by introducing more matrixed reporting relationships. The complexity of matrices can overwhelm managers and limit effectiveness. By establishing organizational priorities for autonomy and synergy, firms can introduce organizational designs and incentive systems to accomplish their priorities. Governance processes—and related incentives—can then compensate for the limitations and instability of organizational structure. These governance processes can be easier to design (if their objectives are clear) and less disruptive to implement. Thus, firms can start governance design by first declaring their organization structure. 7 See Sambamurthy, V. and Zmud, R.W., “Arrangements for Information Technology Governance: A Theory of Multiple Contingencies,” MIS Quarterly (23:2) June 1999, pp. 261–288. The authors find that corporate governance is one of three important contingencies influencing IT governance arrangements in organizations. The other two are absorptive capacity and economies of scope. 8 References to TVA excerpted with permission from Gartner. See “Gartner Executive Programs (EXP) Research,” by Marianne Broadbent and Peter Weill, “Effective IT Governance by Design,” January 2003. © 2004 MIT Sloan—Weill and Ross Page 13
- 17. Third, identify the desirable IT-related behaviors falling outside the scope of organizational structures. Management teams who understand what behaviors organizational structures will enforce can identify the additional behaviors they must promote in order to achieve their objectives for synergy and autonomy. Then, rather than restructuring each time priorities shift, new governance mechanisms can force new behaviors without requiring reorganization. Governance mechanisms can provide organizational stability by demanding disciplined processes. And governance itself appears to become more stable as firms learn good governance practices.9 Together organizational structure and IT governance design allow firms to achieve sometimes conflicting autonomy and synergy objectives. For example, even if organizational structures emphasize the autonomy of individual business units, a firm can establish IT architecture principles that limit business unit technical choices— and achieve enterprise cost objectives. Similarly, IT investment decision processes can direct business unit priorities toward enterprise priorities by approving only projects that support enterprise strategies, even if organizational structures place responsibility for accomplishing project outcomes on business unit managers. In most firms dual incentives are important for motivating senior level managers to focus on both enterprise-wide and business unit goals. However, IT governance designs can encourage desirable behaviors without forcing managers at all levels to regularly reconcile conflicting objectives. Fourth, thoughtfully design IT governance on one page. When the objectives of IT governance are clear, firms can design IT governance by outlining governance arrangements and then specifying the mechanisms that will implement the intended arrangements. Firms that have not been effective in using IT strategically should expect to invest in organizational learning. Early in the learning cycle, those decision making mechanisms may involve large numbers of managers. For example, at Dow Corning, a silicon manufacturer, the senior executive team determined the need to transform IT from back office function to strategic enabler in the mid-1990s.10 For several years the executive committee met regularly to redefine the role of IT, articulate the role of the CIO, establish architectural principles, outline key projects—particularly the implementation of an enterprise system—and closely manage IT investment priorities. Once the full executive committee had entrenched IT as a key function, installed a capable CIO and gained competence in articulating how IT should enable business strategy, ongoing IT governance responsibilities were assumed by a subset of executive committee members. The ability to reduce the size of the steering committee recognized that Dow Corning had created sustainable senior management participation in high level IT management. The smaller steering committee could represent the senior management team and share learning about IT with other senior managers. Making the CIO a member of both the business monarchy and the IT monarchy provided a natural linkage between business and IT strategy. Effective IT governance doesn’t happen accidentally. Firms must establish their needs for synergy and autonomy, recognize the limitations of organizational structure and thoughtfully design IT governance arrangements and specific mechanisms that encourage desirable behaviors. Governance requirements may change as firms change their view of the need for autonomy or 9 In our research firms with effective governance changed some aspect of governance about once per year, whereas firms with less effective governance changed governance as many as three times per year. 10 Ross, J.W. “Dow Corning Corporation: Business Processes and Information Technology,” Journal of Information Technology (14:3), September 1999, pp. 253–266. © 2004 MIT Sloan—Weill and Ross Page 14
- 18. synergy, as they alter the relationships between business units, or as they learn about IT and its role through existing governance mechanisms. Viewing a firm’s IT governance on one page can help with designing, communicating and refining how IT creates business value. A firm’s score on the IT governance performance self assessment is a good indicator for the urgency of action. © 2004 MIT Sloan—Weill and Ross Page 15